So let's get started.
Now we want to handle a post from the login form, so let's duplicate this this route and change it
to a post method and let's change that to post show login, which doesn't exist yet, but we'll create
it in a moment, back over to our handlers.
And I want to create a new function.
And this is going to be of the receiver type repository.
And I want to handle a name post show login.
And of course, it takes a response writer
and a pointer to an issue request.
OK, so what am I going to do in this?
Well, there's only two things coming in from the form.
We have something called username and something called password.
Well, we know we need to handle the CSF protection, so let's go fix that.
Let's go look at how we did that on our Make Reservation page.
We had this line right here.
So let's copy that and go back over to our login page and paste that in just after the opening form
tag.
And let's change that form.
To have method equals post and action equals slash user slash log in there.
Now we should be able to post to this form.
Let's verify that actually works first.
So I'm going to go back to my code and I will find my handlers wherever they're they're there and we'll
just do this log print line works and let's stop our application.
Run the application.
And we'll go over to our login page, which I still have here, but I'll reload the page so it gets
to a token and put some values in here, me out here, dossie test and submit.
And what should happen in my log file is I should see.
No thank you.
I don't want to save that password.
It works.
OK, so they're connected the way they should be.
Perfect.
Now we want to make sure that our authentication procedures use absolutely the best possible security
that's available to us.
And one of the things that I'm going to do right away before I do anything else on this form is I'm
actually going to call a method on our session.
Amde abdon session right there, and I'm going to call a function called Renou Tolkan, and what Renu
Tolkan does is it actually prevents something known as such session fixation, attack every session
that's stored anywhere in an application.
A Web application has a certain Tolkan associated with it.
And when we're doing a log in or log out, it is always good practice to call the Renou token method.
So I'm going to do that.
And all it requires is an argument for the context which I can get right from my response writer.
There, so that's just good practice any time you're doing a log in or log out, make sure you renew
the token and the next thing I'm going to do is pass the form which I've done many times before.
Errors equal are not persse form.
And if there's an error, if error is not equal to nil, then I will just for right now, I'll just
log print line error.
OK, so we've renewed our token for the session.
We've passed our form.
What is next?
Well, let's make sure that we can actually authenticate.
Now, I should be putting a check in here for actually, let's do that right now.
Let's see how we can make sure that that our form has the necessary parameters so forms new and it will
come from our post form.
So now form required and the fields that are required are email and password.
If not formed up valid, then take them back and I'll do the take back in a little bit right now I just
want to get going so we'll to do
take user back to page.
OK, so what?
Do that in a minute.
Otherwise, what I want to do.
Well, I want to try to authenticate this user and I can do that by calling the routine the function
that we just built and added to our repository.
So we're going to call the authenticate method and authenticate if you recur, if you'll recall, returns
three things.
The ID, the hash, which I'm going to ignore right now, the password hash from the database and potentially
an error.
So I'll get that by calling M dot db dot authenticate, which is here somewhere.
There it is authenticate.
And what I'm going to be giving them are the user in the email and the password, which I can get right
from my form from from my posted form request.
So let's get those right here.
First up, just to create variables ver email string and var password string and then we'll actually
populate that information.
Email is this is equal to our form doget email and the same thing for password.
Actually, let's make this a little cleaner, let's do that all in one step and get rid of those variable
declarations, just less code to maintain.
All right.
So I have email and password, and I will pass these as the parameters to my authenticate method, email
and password.
And I check for an error if error is not equal to nil.
And for right now, I'll just log print line error and we'll keep going.
So now if this happens, if they actually sufficiently successfully authenticate, then we can actually
log them in.
And how do we do that?
Well, we're going to do that by storing that ID we just created in the session.
OK, so we will just go m dot app dot session put and it requires the context are context and it requires
a key user ID and it requires a value and the value is going to be ID.
So they're actually logged in.
Now think about what's happening here.
First of all, I know I have to go back and do the form validation.
I'll do that in a little while.
That's why I put the two do there to remind me to do it and my ID helpfully highlights it just to draw
it to my attention.
Then we try to authenticate them.
And right now I'm saying if there's an error of any sort, just log it and keep going.
And that's probably not good.
I do want to log there.
I do want to have a copy of whatever went wrong, but I actually want to do something else.
And what I want to do is take them back to the login form.
So what I can do for right now is say M dot app, dot session, dot put and I'll put our dot contacts.
We need that and I'll put my error and I'll just put invalid login credentials
and then I want to redirect them.
So htp dot redirect which requires a response writer by request.
Are you url user login to take them back to that form and the code I'll put htp dot status c other and
then I want to return because I don't want to do anything else after this point, otherwise it works.
And at that point what do I want to do.
I want to actually take them somewhere else, maybe to the homepage with a success message.
So I'll just copy and paste that and make this flash and put it in a message of logged in successfully
and take them to the homepage and that should do it.
All right.
So right now, of course, we can't test this because we have nothing in the database to authenticate
against.
But this is the basic logic we want to use.
We want to ensure that when they post the login form, that we pass the necessary information, that
we get our email and password from the request.
Then we'll do our some validation, which will add in the next lecture.
Then we authenticate them.
If they don't authenticate, we print the error to the log just so we have it put in session an error
message in the session and take them back to the login screen.
Otherwise we put their user ID in the session.
We store a success message in the session and we take them back to the homepage.
So this looks like it's getting much closer to what we want it to do.
So let's give this a comment.
Handles blogging the user in and save it.
And in the next lecture, we'll add the necessary validation for right here and we'll see what we can
do with that user ID that we've stuck in the session.
What we're going to have to do is write some middleware and the middleware on every request will determine
whether or not the user is logged in.